ICFF：一种IaaS模式下的云取证框架

doi:10.3969/j.issn.1000-436x.2013.05.023

Abstract

Abstract:

Technical challenges of cloud forensics was summarized and a forensics framework under an infrastructure as a service(IaaS) cloud model called ICFF was proposed.Then,this framework on the open source IaaS cloud platform Eucalyptus was implemented.Finally,a test case to demonstrate the effectiveness of ICFF was designed.Experiments show that the framework can obtain evidence data in cloud platform effectively and efficiently.

Key words: cloud computing, digital forensics, cloud forensics, IaaS model

Ya-long XIE,Li-ping DING,Yu-qi LIN,Xiao-ke ZHAO. ICFF: a cloud forensics framework under the IaaS model[J]. Journal on Communications, 2013, 34(5): 200-209.

Figures/Tables 8

References 18

[1]	SIMSON L G . Digital forensics research: the next 10 years[J]. Digital Investigation, 2010,(7):64-73.
[2]	WOLTHUSEN S D . Overcast: forensic discovery in cloud environ-ments[A]. The 5th International Conference on IT Security Incident Manage ment and IT Forensics[C]. Stuttgart, 2009. 3-9.
[3]	KEYUN R, , JOE C , TAHAR K , et al . Cloud forensics: an overview[A]. 7th IFIP Conference on Digital Forensics[C]. Florida,USA, 2011. 35-46.
[4]	BIGGS S , VIDALIS S . Cloud computing: the impact on digital foren-sic investigations[A]. International Conference for Internet Technol-ogy and Secured Transactions[C]. London,Engloud, 2009. 1-6.
[5]	BIRK D , WEGENER C . Technical issues of forensic investigations in cloud computing environments[A]. IEEE 6th International Workshop on Systematic Approaches to Digital Forensic Engineering[C]. Oak-land, 2011. 1-10.
[6]	Eucalyptus[EB/OL]. http://www.eucalyptus.com/.
[7]	NURMI D , WOLSKI R , GRZEGORCZYK C , et al . The eucalyptus open-source cloud-computing system[A]. IEEE/ACM International Sym-posium on Cluster Computing and the Grid[C]. Shanghai,China, 2009. 124-131.
[8]	KEYUN R , IBRAHIM B , JOE C , et al . Survey on cloud forensics and critical criteria for cloud forensic capability: a preliminary analysis[A]. Proceedings of the ADFSL Conference on Digital Forensics,Security and Law[C]. Virginia,USA, 2011. 105-121.
[9]	REILLY D , WREN C , BERRY T . Cloud computing: forensic challenges for law enforcement[A]. International Conference for Internet Technology and Secured Transactions[C]. London,En-gloud, 2010. 1-7.
[10]	ELIE B , IVAN F , MATTHIEU M , et al . Doing forensics in the cloud age OWADE: beyond files recovery forensic[A]. Black Hat[C]. Las-Vegas,USA, 2011. 1-23.
[11]	ZAFARULLAH Z , ANWAR F , ANWAR Z . Digital forensics for eucalyptus[A]. Frontiers of Information Technology[C]. Islamabad, 2011. 110-116.
[12]	周刚 . 云计算环境中面向取证的现场迁移技术研究[D]. 武汉：华中科技大学， 2011.
[13]	WU J Z , DING L P , WANG Y J , et al . Identification and evaluation of sharing memory covert timing channel in xen virtual machines[A]. IEEE 4th Conference on Cloud Computing[C]. Washington DC,USA, 2011. 283-291.
[14]	WU J Z , DING L P , LIN Y Q , et al . Xenpump: a new method to miti-gate timing channel in cloud computing[A]. IEEE 5th Conference on Cloud Computing[C]. Hawaii,USA, 2012. 678-685.
[15]	PAUL B , BORIS D , KEIR F , et al . Xen and the art of virtualization[A]. Proceedings of the Nineteenth ACM Symposium on Operating Sys-tems Principles[C]. New York,USA, 2003. 164-177.
[16]	XU W , HUANG L , FOX A , et al . Detecting large-scale system prob-lems by mining console logs[A]. Proceedings of the ACM SIGOPS 22nd Symposium on Operating Systems Priciples[C]. New York,USA, 2009. 117-132.
[17]	HU Z B , SU J , SHIROCHIN V P . An intelligent lightweight intrusion detection system with forensics technique[A]. 4th IEEE Workshop on Intelligent Data Acquisition and Advanced Computing Systems:Technology and Applications[C]. Dortmund, 2007. 647-651.
[18]	CVE-2008-4250[EB/OL].

Metrics

Recommended 0

No Suggested Reading articles found!

时间	来源	事件	描述
2012-6-13 15:51:36	VM01-Browser	8032	浏览器服务已很多次无法正常启动
2012-6-13 15:51:46	VM01-Security	680	源工作站：VvvWoTb5JV
2012-6-13 15:51:46	VM01-Security	529	源网络地址：192.168.1.110
2012-6-13 15:52:14	VM01-Security	592	已经创建新的过程

时间	来源	进程ID	进程名
2012-6-13 15:50:54	VM01	1964	mshta.exe
2012-6-13 15:50:56	VM01	1032	mmc.exe
2012-6-13 15:52:14	VM01	2348	cmd.exe
2012-6-13 15:53:10	VM01	1152	ftp.exe
2012-6-13 15:54:31	VM01	1604	sfind.exe
2012-6-13 15:56:03	VM01	3372	G_Server.exe

ICFF: a cloud forensics framework under the IaaS model

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 8

References 18

Related Articles 15

Metrics

Recommended 0

[1]	Ling MA, Qiliang FAN, Ting XU, Guanchen GUO, Shenglin ZHANG, Yongqian SUN, Yuzhi ZHANG. Scheduling framework based on reinforcement learning in online-offline colocated cloud environment [J]. Journal on Communications, 2023, 44(6): 90-102.
[2]	Huaqun WANG, Zhe LIU, Debiao HE, Jiguo LI. Identity-based provable data possession scheme for multi-source IoT terminal data in public cloud [J]. Journal on Communications, 2021, 42(7): 52-60.
[3]	Jianhong ZHANG, Menglong WU, Jing WANG, Pei LIU, Zhengtao JIANG, Changgen PENG. Secure and verifiable multi-keyword searchable encryption scheme in cloud [J]. Journal on Communications, 2021, 42(4): 139-149.
[4]	Ruiqi LI, Chunfu JIA, Yafei WANG. Multi-key homomorphic proxy re-encryption scheme based on NTRU and its application [J]. Journal on Communications, 2021, 42(3): 11-22.
[5]	Jiawei ZHANG, Jianfeng MA, Zhuo MA, Teng LI. Time-based and privacy protection revocable and traceable data sharing scheme in cloud computing [J]. Journal on Communications, 2021, 42(10): 81-94.
[6]	Wenjuan WANG, Xuehui DU, Dibin SHAN. Construction method of attack scenario in cloud environment based on dynamic probabilistic attack graph [J]. Journal on Communications, 2021, 42(1): 1-17.
[7]	Youliang TIAN,Qin LUO. Verifiable multi-keyword search scheme based on improved Merkle-Tree authentication method [J]. Journal on Communications, 2020, 41(9): 118-129.
[8]	Na WANG,Kun ZHENG,Junsong FU,Jian LI. Method of ciphertext retrieval in mobile edge computing based on block segmentation [J]. Journal on Communications, 2020, 41(7): 95-102.
[9]	Lindong ZHAO,Wenqin ZHUANG,Jianxin CHEN,Liang ZHOU. Hierarchical task offloading in heterogeneous cellular network:modeling and optimization [J]. Journal on Communications, 2020, 41(4): 34-44.
[10]	Bing LIANG,Wen JI. Multiuser computation offloading for edge-cloud collaboration using submodular optimization [J]. Journal on Communications, 2020, 41(10): 25-36.
[11]	SU Mingfeng,WANG Guojun,LI Renfa. Multidimensional QoS cloud computing resource scheduling method based on stakeholder perspective [J]. Journal on Communications, 2019, 40(6): 102-115.
[12]	CHEN Xingshu,HUA Qiang,WANG Yitong,GE Long,ZHU Yi. Research on low-rate DDoS attack of SDN network in cloud environment [J]. Journal on Communications, 2019, 40(6): 210-222.
[13]	Wanliang WANG, Zelin ZANG, Guoqi CHEN, Hangyao TU, Yule WANG, Linyan LU. Research on optimal two element exchange algorithm for large scale cloud computing server scheduling problem [J]. Journal on Communications, 2019, 40(5): 180-191.
[14]	Tian WANG,Xuewei SHEN,Hao LUO,Baisheng CHEN,Guojun WANG,Weijia JIA. Research progress of trusted sensor-cloud based on fog computing [J]. Journal on Communications, 2019, 40(3): 170-181.
[15]	Xinfeng HE,Junfeng TIAN,Fanming LIU. Survey on trusted cloud platform technology [J]. Journal on Communications, 2019, 40(2): 154-163.